streak-map-kit

GHSA-qjg3-27xw-6xvr

Malicious code in streak-map-kit (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (2790159028b31b656c9e704c3a0e4b1a5d114042e0d92c601d133057f760b537)
streak-map-kit is advertised as a dependency-free calendar-day/streak math library but ships a Linux ELF at dist/internal/calc-mapping.bin framed as a 'native math accelerator'. The main entry's top-level async IIFE chmods the ELF to 0755 and spawns it as a detached child process whenever the module is imported, so any consumer that requires the package on Linux drops the binary as a running process. The ELF (internally named REDSHELL) beacons to a hardcoded C2 at http://217.60.77.63 and implements a full remote-shell command surface: /sysinfo, /ps, /env, /ls, /cat, /download, /upload, /ssh_keys, /creds, /dbfind, /clipboard, /kill, /spawn, /adduser, /enableuser, /sessions, with unmatched input executed via /bin/sh or /bin/bash. It exfiltrates arbitrary filesystem paths and harvested SSH keys and stored credentials via chunked POSTs to http://217.60.77.63/api/extract-receive (BIGEXTRACT_START, Loot_%s_%s_%s tagging). Second-stage payloads are fetched from http://217.60.77.63/Others/ and http://217.60.77.63/SC/ over plaintext HTTP with no verification, staged in /tmp, and executed; a memfd_create-based fileless-exec path via a python3 syscall(319) trampoline and /dlopen and /stage commands provide arbitrary further code loading. Persistence is installed by writing ~/.config/systemd/user/svc-update.service (Description='System Update Service', ExecStart=/proc/self/exe, Restart=always) and enabling it via systemctl --user, with cron, bashrc, and xdg autostart alternatives. The beacon also offers a SOCKS5 proxy, arbitrary TCP port-forwarding, and an RC2TUN tunneling protocol that spawns /bin/bash, turning the host into a pivot into reachable internal networks. Cover-story framing (comments describing a 'high-performance streak computation engine', a hardcoded sha256 'integrity verification — critical security gate', a 'Native accelerator loaded and verified' log line, and a README claim that the module performs no side eff […]

**References:**
- https://github.com/ossf/malicious-packages/blob/8fbe9d43ae060c65fa798b21da8b6fd1af364479/osv/malicious/npm/streak-map-kit/MAL-2026-13628.json
- https://www.npmjs.com/package/streak-map-kit/v/1.0.0
- https://github.com/advisories/GHSA-qjg3-27xw-6xvr

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.